DSA-3960: -1 gnupg -- security update

Published Sep 1, 2017

Updated

Daniel J. Bernstein, Joachim Breitner, Daniel Genkin, Leon Groot Bruinderink, Nadia Heninger, Tanja Lange, Christine van Vredendaal and Yuval Yarom discovered that GnuPG is prone to a local side-channel attack allowing full key recovery for RSA-1024.

Affected Software

2 affected components

debian/gnupg

Event History

Sep 1, 2017

Advisory Published

12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2017-7526

Frequently Asked Questions

Which keys are susceptible to recovery through this issue?

The issue allows full recovery of RSA-1024 keys. The provided advisory does not identify other key types or RSA key sizes as affected.

Does exploiting this issue require remote access?

No. The advisory characterizes it as a local side-channel attack, so the attacker needs local access or a local execution foothold on the affected system.

DSA-3960: -1 gnupg -- security update

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Which keys are susceptible to recovery through this issue?

Does exploiting this issue require remote access?

Company

Resources

Contact

Frequently Asked Questions

Which keys are susceptible to recovery through this issue?

Does exploiting this issue require remote access?